CVE-2024-45023

HIGH EPSS 8.0%
Published Sep 11, 20241y ago · Modified Jun 17, 20261w ago
7.1 CVSS 3.1
High
Find Similar
Published Sep 11, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: md/raid1: Fix data corruption for degraded array with slow disk read_balance() will avoid reading from slow disks as much as possible, however, if valid data only lands in slow disks, and a new normal disk is still in recovery, unrecovered data can be read: raid1_read_request read_balance raid1_should_read_first -> return false choose_best_rdev -> normal disk is not recovered, return -1 choose_bb_rdev -> missing the checking of recovery, return the normal disk -> read unrecovered data Root cause is that the checking of recovery is missing in choose_bb_rdev(). Hence add such checking to fix the problem. Also fix similar problem in choose_slow_rdev().

CVSS Details

Base Score
7.1
Exploitability
1.8
Impact
5.2
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
8.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 4

VendorProductVersionRange
linuxlinux_kernel*≥6.9  –  <6.10.7
linuxlinux_kernel6.11any
linuxlinux_kernel6.11any
linuxlinux_kernel6.11any

References 2

  • git.kernel.org https://git.kernel.org/stable/c/2febf5fdbf5d9a52ddc3e986971c8609b1582d67
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c916ca35308d3187c9928664f9be249b22a3a701
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/2febf5fdbf5d9a52ddc3e986971c8609b1582d67
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c916ca35308d3187c9928664f9be249b22a3a701
    Patch